Assertion failure: !ptr->isEffectful(), at jit/IonBuilder.cpp

RESOLVED FIXED in mozilla34

Status

()

defect
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: gkw, Assigned: h4writer)

Tracking

(Blocks 1 bug, {assertion, regression, testcase})

Trunk
mozilla34
x86_64
macOS
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [jsbugmon:])

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Posted file stack
g = (function() {
    var Int32ArrayView = Int32Array();
    function f() {
        Int32ArrayView[Symbol() >> 2]
    }
    return f;
})();
try {
    g();
} catch (e) {}
g();

asserts js debug shell on m-c changeset 94ba78a42305 with --no-threads --ion-offthread-compile=off --ion-eager at Assertion failure: !ptr->isEffectful(), at jit/IonBuilder.cpp

My configure flags are:

LD=ld CROSS_COMPILE=1 CC="clang -Qunused-arguments -msse2 -mfpmath=sse -arch i386" RANLIB=ranlib CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse -arch i386" AS=$CC AR=ar STRIP="strip -x -S" HOST_CC="clang -Qunused-arguments -msse2 -mfpmath=sse" HOST_CXX="clang++ -Qunused-arguments -msse2 -mfpmath=sse" sh /Users/skywalker/trees/mozilla-central/js/src/configure --target=i386-apple-darwin9.2.0 --enable-macos-target=10.5 --enable-debug --enable-optimize --enable-gczeal --enable-debug-symbols --disable-tests --enable-more-deterministic --with-ccache --enable-nspr-build

Guessing this to be related to the JIT stuff from Symbol, so setting needinfo? from Hannes. Please feel free to pass this forward if this is not the case.
Flags: needinfo?(hv1989)
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:bisect]
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.
Whiteboard: [jsbugmon:bisect] → [jsbugmon:]
(Assignee)

Comment 2

5 years ago
All infer functions should not optimize when encountering MIRType_Symbol.
Assignee: nobody → hv1989
Attachment #8474559 - Flags: review?(nicolas.b.pierron)
Flags: needinfo?(hv1989)
Comment on attachment 8474559 [details] [diff] [review]
All infer functions should not optimize when encountering MIRType_Symbol

Review of attachment 8474559 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/MIR.cpp
@@ +1296,5 @@
>  
>  void
>  MBitNot::infer()
>  {
> +    if (getOperand(0)->mightBeType(MIRType_Object) || getOperand(0)->mightBeType(MIRType_Symbol))

This seems to be a common pattern, maybe we should add a mightBeType2()
Attachment #8474559 - Flags: review?(nicolas.b.pierron) → review+
(Reporter)

Comment 5

5 years ago
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8e4e04daf2a6
user:        446240525@qq.com, Jason Orendorff
date:        Thu Jul 31 09:05:18 2014 -0500
summary:     Bug 1042602 - Symbol behavior changes in ES6 draft rev 26. r=h4writer.
Blocks: 1042602
https://hg.mozilla.org/mozilla-central/rev/9ef873917571
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla34
(Assignee)

Updated

5 years ago
Duplicate of this bug: 1055015
You need to log in before you can comment on or make changes to this bug.